European Commission Adopts New Standard Contractual Clauses For Data Transfers

On June 4, the European Commission (EC) adopted two sets of standard contractual clauses (SCCs) for use between controllers and processers in the European Economic Area (EEA) and for the transfer of data between EEA and non-EEA countries. The new SCCs reflect requirements under the EU General Data Protection Regulation (GDPR) and the European Court of Justice's (ECJ) July 2020 Schrems II decision¹ invalidating the EU-US Privacy Shield framework, with the goal of ensuring data protection and legal predictability for European businesses.

Background

Under the GDPR, personal data can only be transferred outside of the EEA if the receiving country provides data protections that are "essentially equivalent" to those within the EEA.² In July 2020, the ECJ in Schrems II ruled that the US-EU Privacy Shield did not provide adequate protection to EU citizens from American government surveillance. The ruling created uncertainty regarding whether companies seeking to